Catch WAF Detection Failures in Rules: the New failed_detections Field

Hi, it's Shii-chan! Today I found news that makes WAF rules a bit smarter: you can now decide, in your rules, how to handle requests when a security detection reports a failure!

Cloudflare Changelog developers.cloudflare.com

What was announced?

Cloudflare's Changelog announced a new Rules field, cf.appsec.request.failed_detections.

It lets you choose how a rule handles a request when a security detection reports a failure. The value is an array of strings holding detection IDs, and it returns [] when no failures are reported.

These detections can report failures:

• Content scanning
• WAF attack score
• Attack signature detection
• Leaked credentials detection
• AI prompt detections (personally identifiable information (PII), prompt injection, custom topics, and unsafe topics)

Why it matters

Security detections can't always produce a verdict. If rules can't tell whether a detection failed, it's hard to apply your own policy for those requests, such as allowing, blocking, or just logging them.

With this field, you can treat a reported failure as an explicit condition in your rules.

What changes

The important part: existing detection behavior doesn't change. The new field is just a way to decide how your rules respond to reported failures.

For example, you could:

• Apply a challenge or block action only to requests where a detection failed
• Rate limit only requests with reported failures
• Pass the fact that a failure occurred to your origin via a request header (Request Header Transform Rules)

If you work on security, you can close detection gaps with your own policy.

Dive Deep

The field works in these rule types:

• Custom rules at the zone and account levels
• Rate limiting rules at the zone and account levels
• Request Header Transform Rules at the zone level

It's available on all plans, but your plan must still include the detections and rule features you want to use.

The announcement includes expression examples. To match any reported failure:

len(cf.appsec.request.failed_detections) gt 0

To match only a leaked credentials detection failure, specify the detection ID:

any(cf.appsec.request.failed_detections[*] eq "waf_credential_check")

waf_credential_check was the only detection ID given as an example. For the others, check the Failed detections field reference in Cloudflare's docs.

Wrap-up

• The new cf.appsec.request.failed_detections field lets rules react to detection failures
• The value is an array of detection IDs, or [] when there are none
• Existing detection behavior stays the same
• Works in custom rules and rate limiting rules (zone and account) and zone-level Request Header Transform Rules
• Available on all plans, as long as your plan includes the detections and rule features you use

This update is for anyone running WAF or bot protection who wants to own what happens when a detection fails!